Fundamental Points of the ABScard Technology

Transcription

1 Fundamental Points of the ABScard Technology Architettura ABSCARD Pagina 1 di 13

2 General Index 1.Architecture Introduction Security Management ABScard enterprise version Verticalizations System Architecture Presentation Identification Application Database ABScard Function Diagram Installation Prerequisites Hardware Prerequisites Prerequisiti Software...13 Architettura ABSCARD Pagina 2 di 13

3 1.Architecture 1.1 Introduction ABScard is a transactional system developed with multi-tier technology, in order to guarantee a high degree of separation between the data and the presentation of the data. The use of Java language and TCP/IP protocol allows the system to be implemented through various types of servers (Windows, Linux, UNIX, etc.) The possibility to host the database on servers with high levels of security and performance (ex. Mainframe IBM, UNIX servers, Windows servers) along with its modular architecture make the ABScard able to carry out an elevated number of transactions per second. The ABScard system is multichannel, and the system is able to elaborate transactions coming from: Internet : interfaced through a browser. POS terminals and/or smart-card reader terminals: on hardware using ABScard software Hand-held devices/smartphone Self-Service terminals Mobile Phones: transactions formatted through GSM messages Thanks to the capacity to run transactions through POS terminals and mobile phones, ABScard extends the benefits of an innovative transactional system to traditional circuits. ABScard is the ideal solution for: Payment systems Customer loyalty and point accumulation systems Authentication systems Electronic ticket offices Municipal ID cards for citizens Online betting Mobile phone recharge or debit card recharge Architettura ABSCARD Pagina 3 di 13

4 1.1.1 Security The security of the transactions is one of the principle characteristics of the system, on the internet channel ABScard makes use of the most recent technology available today. The transaction data are encrypted with symmetric public key algorithms and authentification. The encrypting algorithm used in this version of the software is rijndael, which has been certified by NIST (National Institute of Standard and Technology, USA) as well as the new AES (Advanced Encription Standard). In addition, the session keys have a duration limited to the transaction, making any brute force attack, besides practically impossible, also inconsequential (the session key changes constantly). Further security is provided by strong-authentication which confirms the reciprocal authentication between the server application and the client. This provides protection against attacks using pirate-applet mecchanisms. On the POS channel, the ABScard protocal allows for various levels of security, from clear transmission to transaction encryption using banking standards. Architettura ABSCARD Pagina 4 di 13

5 1.1.2 Management The system management is done through software modules with internet browser type interfacing. This allows the installation of work units to be as simplified as possible. Security is guaranteed by a system of personized access, which selectively authorizes the access to management functions. In addition, every operation is performed by the server with a transaction, which guarantees the security and registration of all activity. The management transactions all the following type of operations to be performed: Back-Office o Management of system tables o Batch elaborations o Pre-established queries o Dynamic queries o Management of internal security profiles o Management of Retailers Help-desk o Card Management o Merchant Management o Client terminal management (ex. POS) o Operator profile management Through the configuration files it is possible to personalize the menus and queries, in order to rapidly and independently personalize/verticalize the system. Architettura ABSCARD Pagina 5 di 13

6 1.1.3 ABScard enterprise version Verticalizations The enterprise version of the ABScard server allows the system to be integrated and/or personalized. The following are possible: Advanced integration with external informative structures (ex. Gateway/Service Providers) Perform user application. New transactions (Java language) able to expand the current functions of the system or to create new applications. The user transactions allow enterprise applications to be created rapidly, taking advantage of the architeture of a system that is transactional, scalable and multi-platform. Enterprise functions are available even on ABScard certified client platforms (ex. POS), which allow a great flexibility in the implementation of new transacions or the personalization of existing ones. Architettura ABSCARD Pagina 6 di 13

7 1.2 System Architecture The system is structured in four levels or tiers, each single level performs a specific system function. The levels are defined as follows: Presentation Identification Application Database The separation into multiple levels allows the system to be installed making the best use of the hardware architecture, which has been conceptualized according to the highest possible security levels. The transactions are developed using the concept of channels, which allows for a versatile system respect to the transmissive channel, that is interfaced only on the Presentation level. The relationship between levels is represented by the following diagram: Presentation I dentification Application Database Figure 1. Architettura ABSCARD Pagina 7 di 13

8 1.2.1 Presentation The presentation level is performed by one or more servers specialized in the channel function (gateway server) from which the transactions are received. The task of the presentation level is to carry out all of the specific functions of a determined channel and to streamline communication with the successive levels. On the internet channel, the function is performed through a web-server, which must support the execution of active pages (typically JSP) and be able to recall Java classes. The execution of the transactions does not require any application to be installed; the interfacing is done through an internet browser. The applied logic of the presentation is done through Java applet. On the POS channel, the presentation function is performed by a POS gateway server, which interfaces with the periferical communication devices towards the POS terminals. The execution of the transactions takes place through POS terminal, or hardware devices with smart-card readers, that have the client-pos ABScard software installed. The terminals connect to the server through one of the typical means of communication, such as a dedicated telephone line, a LAN/GPRS connection or serial connection. The concentration is done either by concentration device hardware or by service providers (ex. TNS). The server acts as the gateway towards the identification level. On the Mobile channel, the presentation function is performed by a GSM gateway server, that is able to communicate with devices or channels of transmission/reception of SMS messages towards the SMS service provider. The execution of the transaction takes place through telephones, typically mobile telephones, able to send SMS messages. The use of TCP protocol and encryption allows the presentation level to be geographically distributed in respect to the server applications. Architettura ABSCARD Pagina 8 di 13

9 1.2.2 Identification The identification level is implemented by one or more specialized server applications (called Identification Servers). Cyphering/deciphering the transactions Transaction identification Proxing of the transactions applied on one or more application server The function of proxing allows the transaction load to be distributed to multiple applied servers. Therefore, it is possible to specialize the servers for transaction groups. For volumes of elevated transactions, this function can be integrated with hardware devices for traffic balancing, that allows for the creation of redundant architecture at a high level of service Application The application level is implemented by one or more server applications. The server communicates with the identification level and normally accesses data by communicating with the database level by way of multiple connections (connection pool). An application server (APS) carries out the following functions: Syntactical check of the transactions Elaboration of the transactions Composition of the reply Registration (logging) Database The database level is implemented using a relational type database. The DBMS, to be compatible with the ABScard server, must be able to support SQL transactions and multiple connections via DJBC connections. Architettura ABSCARD Pagina 9 di 13

10 1.3 ABScard Function Diagram The following diagram shows the flow of a generic transaction coming from different clients. Protocol Converter HW or Protocol Converter Provider PTSN/GPRS POS Gateway ABScard Telephone Recharge (Jastfin) TCP/IP WebServer Gateway Application/ Identification Server ABScard Bet Providers Bank (acquirer Visa) Gateway GSM ABScard Database TCP/IP GSM PROVI DER Client Tier Service Delivery Center ABS Service Provider Tier Figure 2. Architettura ABSCARD Pagina 10 di 13

11 The elevated versatility allows the activation of a congruous number of servers for elevated transactional loads, or to concentrate the identification and application functions on a sole server. The separation of the protocol from the transactions (based on XML) and the presentation level allows for the modification of existing interfaces or the implementation of new communication channels, leaving the application server architecture unchanged. Architettura ABSCARD Pagina 11 di 13

12 1.4 Installation Prerequisites Hardware Prerequisites The ABScard system was developed to be independent from the hardware platform. It can be installed on a variable number of servers depending on the transactional volume that the system must support. The communication through TCP/IP Protocol, limited to the ports used, must be allowed between the servers that host the system and that are separate from systems of a hardware or software type. The number and the strength of the servers on which the system is installed is based on the transactional volume that must be guaranteed, from the access channel and also from the type of the transactions themselves. The web server, given the limited space on the disk and the elaborative load required by the system, does not require any particular strength. It is, however, necessary to adequately size the internet access keeping in mind the average dimensions of the pages (especially those containging applet) and the number of simultaneous connections that must be guaranteed. The Identification Server, having the highest elaborative load due to encryption, must be characterized by an adequate power in CPU. A multiprocessor server is often necessary, also to guarantee adequate transaction response times. The Application Server does not have specific characteristics, being above all the most easily expandible level (thanks to the transaction balancing function of the identification server). It can be flanked by other servers if necessary. The database server obviously requires characteristics regarding reliability in terms of data storage. Architettura ABSCARD Pagina 12 di 13

13 1.4.2 Prerequisiti Software Component Software Platform Notes Identification Server Multiplatform Requires Java Runtime 1.4 or higher. Application Server Multiplatform Requires Java Runtime 1.4 or higher. POS Server Multiplatform Requires Java Runtime 1.4 or higher. Database Multiplatform Certified with Microsoft SQL Server, MySQL, Oracle. Requires database with JDBC interface. Gateway Internet Multiplatform Requires WEB Server compatibile con JSP o ASP Gateway GSM Multiplatform Requires Java Runtime and specific interface with SMS carrier Helpdesk/backoffice via WEB Helpdesk/backoffice Client Multiplatform Multiplatform Requires WEB Server JSP or ASP compatible Requires Java Runtime 1.4 or higher. Architettura ABSCARD Pagina 13 di 13